@ai-ecoverse/slicc-kernel 1.101.0 → 1.102.1

package/dist/process-worker.js

@@ -2458,6 +2458,11 @@ function devRemoval(path, cred) {
   if (cred && cred.euid !== 0) return "EACCES";
   return path === "/dev" ? "EBUSY" : "EPERM";
 }
+function devCreation(path, cred) {
+  if (path === "/proc" || path.startsWith("/proc/")) return "EROFS";
+  if (path === "/dev" || !inDevTree(path)) return void 0;
+  return cred && cred.euid !== 0 ? "EACCES" : "EPERM";
+}
 var SHM;
 var init_dev_removal = __esm({
   "src/fs/dev-removal.ts"() {
@@ -2475,7 +2480,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.101.0" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.102.1" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });
@@ -3308,6 +3313,53 @@ function kernelLink(imports, fs, memory, glue) {
     true
   );
 }
+function refusedCreation(Fs, heap, dirfd, ptr) {
+  const name2 = cString(heap, ptr);
+  const path = absoluteOf(name2, name2.startsWith("/") ? "/" : baseOf2(Fs, dirfd));
+  const refused2 = devCreation(path, Fs.sliccCred);
+  if (!refused2 || !Fs.lookupPath) return 0;
+  try {
+    Fs.lookupPath(path, { follow: false });
+    return 0;
+  } catch {
+    return -wasiErrno(refused2);
+  }
+}
+function devCreations(imports, fs, memory, glue) {
+  const check = (dirfd, ptr) => {
+    const Fs = fs();
+    const heap = memory();
+    return Fs && heap ? refusedCreation(Fs, heap, dirfd, ptr) : 0;
+  };
+  wrapImport(
+    imports,
+    "openat",
+    glue,
+    (own) => (dirfd, path, flags, varargs) => flags & O_CREAT && check(dirfd, path) || own(dirfd, path, flags, varargs),
+    true
+  );
+  wrapImport(
+    imports,
+    "mkdirat",
+    glue,
+    (own) => (dirfd, path, mode) => check(dirfd, path) || own(dirfd, path, mode),
+    true
+  );
+  wrapImport(
+    imports,
+    "mknodat",
+    glue,
+    (own) => (dirfd, path, mode, dev) => check(dirfd, path) || own(dirfd, path, mode, dev),
+    true
+  );
+  wrapImport(
+    imports,
+    "symlinkat",
+    glue,
+    (own) => (target, dirfd, path) => check(dirfd, path) || own(target, dirfd, path),
+    true
+  );
+}
 function kernelUname(imports, hostname, memory, glue) {
   const fields = ["Linux", hostname, OS_RELEASE, "#1 SMP PREEMPT_DYNAMIC", "wasm32", "(none)"];
   const encoded = fields.map((f) => new TextEncoder().encode(f).subarray(0, UTS_FIELD - 1));
@@ -3394,6 +3446,7 @@ var init_process_fds = __esm({
       umask: "__syscall_umask",
       faccessat: "__syscall_faccessat",
       linkat: "__syscall_linkat",
+      symlinkat: "__syscall_symlinkat",
       uname: "__syscall_uname",
       utimensat: "__syscall_utimensat",
       getppid: "slicc_getppid_js",
@@ -5638,6 +5691,7 @@ function kernelWrappers(imports, module, deps) {
   noFollowUtimes(imports, fsOf, kernelGlue?.utimensat ?? utimensatOf(module), memory);
   kernelAccess(imports, fsOf, memory, kernelGlue);
   kernelLink(imports, fsOf, memory, kernelGlue);
+  devCreations(imports, fsOf, memory, kernelGlue);
   kernelUname(imports, hostnameOf(init.env), memory, kernelGlue);
   const glue = ownValue(module, "sliccFdImports");
   syncFsync(imports, fsOf, glue);
@@ -5957,6 +6011,7 @@ var init_process_runtime = __esm({
       "  umask: typeof ___syscall_umask === 'function' ? ___syscall_umask : undefined,",
       "  faccessat: typeof ___syscall_faccessat === 'function' ? ___syscall_faccessat : undefined,",
       "  linkat: typeof ___syscall_linkat === 'function' ? ___syscall_linkat : undefined,",
+      "  symlinkat: typeof ___syscall_symlinkat === 'function' ? ___syscall_symlinkat : undefined,",
       "  uname: typeof ___syscall_uname === 'function' ? ___syscall_uname : undefined,",
       "  utimensat: typeof ___syscall_utimensat === 'function' ? ___syscall_utimensat : undefined,",
       "  getppid: typeof _slicc_getppid_js === 'function' ? _slicc_getppid_js : undefined,",